Privacy Notice
1. Who is responsible
The controller of your personal data is Jan Zuska, a private individual in the Czech Republic who runs FISHAO.eu as a non-commercial hobby project. Contact for all privacy questions: contact@fishao.eu. FISHAO.eu is an unofficial fan project; GamoVation B.V. is not responsible for the data processed here.
2. What we process
- Account: username, password (stored only as a salted scrypt hash, never in plain text), e-mail address, date of birth, game language, the invite code used, when you registered and when you accepted these documents.
- Game data: your character, level, inventory, catches, money, friends, club, trades, rankings, missions, settings (country, time zone, sound), private messages and the last 300 of your chat messages.
- Technical and security data: IP address, browser (user agent), the pages and game files requested and when, login times, and data from the anti-cheat checks (timings of moves and catches, the game's clock, flags and their results).
- Device ID: a random code that the game stores in Flash's own storage on your computer and sends when you log in. It contains nothing about you or your computer; it lets us recognise the same computer across accounts to stop cheating and banned players coming back (security, section 3).
- Error reports: when the game crashes, it sends us its error log and a screenshot of the game screen, together with your IP address and username.
We do not collect payment data, we do not use advertising or tracking cookies, and we do not use analytics services.
3. Why and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Running your account and the game, saving your progress, chat and messages, password reset | Art. 6(1)(b) – providing the Service you signed up for |
| Security: protecting accounts and servers, stopping cheating, bots, abuse and mass downloading of the game files, finding and fixing errors | Art. 6(1)(f) – our legitimate interest in a safe and fair game |
| Checking the minimum age (date of birth) | Art. 6(1)(b) and (f) |
| Community posts on our Discord server (see section 5) | Art. 6(1)(f) – our legitimate interest in running the community |
| Answering your messages and requests | Art. 6(1)(b) or (f) |
You may object to processing based on legitimate interest (Art. 21 GDPR) at any time.
4. Automated checks
The server checks game actions automatically. Impossible actions (for example catches or movement faster than the game allows) can be refused, and repeated ones disconnect the player; unusual mass downloads of the game files block access to them for 24 hours. These measures are temporary, every one is recorded for review by the administrators, and you can contest them at contact@fishao.eu. Bans are decided by people, not by the system.
5. Who receives data
- Hosting: DigitalOcean, LLC runs our server and database in Frankfurt, Germany (EU) as our processor. As DigitalOcean is a US company, possible access from the USA is covered by its data processing agreement with the EU Standard Contractual Clauses.
- Discord: our Discord server (run by Discord Inc., USA) shows a welcome message with the username of new players and the usernames and results of event winners. Administrators receive the username, invite code and anti-cheat notices in a private channel. Discord processes this under its own privacy policy; transfers to the USA rely on the EU–US Data Privacy Framework or Standard Contractual Clauses.
- E-mail: password reset e-mails are sent through an e-mail delivery provider acting as our processor.
- Other players see your username, character, level, profile and what you write in chat. Your profile shows your age (not your date of birth) unless you hide it in the game settings; your e-mail address is never shown to other players.
- Authorities, only where the law requires it.
We do not sell or rent personal data and do not share it for advertising.
6. How long we keep it
| Data | Kept |
|---|---|
| Access logs (IP, pages and files requested) | 30 days |
| Server logs | 14 days |
| Security logs (logins, anti-cheat flags, bans, administrator actions) | 180 days |
| Error reports with screenshots | at most 90 days |
| Database backups | 14 days (plus 7 days of provider backups) |
| Device IDs (the last 10 per account) | while the account exists; deleted with it |
| Account and game data | while the account exists; deleted on request |
7. Cookies and storage in your browser
We use only what is needed to run the site: fishao_session (keeps you logged in, 24 hours), fishao_play (allows your browser to load the game files, 12 hours) and site_lang (your website language, 1 year). The game page remembers the window size in your browser's local storage, and the Flash game stores its own settings (such as sound) on your computer. The game also keeps its random device ID there (section 2). No consent is needed for these strictly necessary items.
8. Your rights
You can ask for access to your data, correction, deletion, restriction, a copy in a portable format, and you can object to processing based on legitimate interest. Write to contact@fishao.eu, preferably from the e-mail address of your account; we may ask you to confirm that the account is yours. We answer within one month. You can also complain to the Czech Office for Personal Data Protection (ÚOOÚ, uoou.gov.cz) or the data protection authority of your country.
9. Security
The website uses HTTPS, passwords are stored only as salted hashes, the database is reachable only from our server, and only the administrators can see the logs. No system is perfectly secure; if a data breach puts your rights at risk, we will inform you and the authority as the law requires.
10. Children
You must be at least 13 to register. If you are younger than 16 (or than the age set by your country), please ask a parent or guardian first. If we learn that a child registered against these rules, we delete the account. Parents can contact us at contact@fishao.eu.
11. Changes
When this notice changes, the date above changes too; important changes are announced and you will be asked to accept them again before you play.